Internet users regularly register with websites, cloud applications, or other web-based programs (each hereinafter a “website”). The user's registration information is generally kept confidential and used for the purpose of allowing the registrant or user to enter the website through a login process, and access the services offered by the website.
Fundamental to every secure transaction is user or registrant identity authentication. Identity authentication is particularly important with Internet-based transactions where user identity cannot be verified by more traditional means such as visual inspection and verification of a government-issued photo identification card. Reliable authentication and identity verification of businesses and/or individuals that engage in Internet-based commerce or information exchange is therefore a business necessity. Despite these authentication requirements, fraud is still prevalent on the Internet and often Internet fraud-impostors or “fraudsters” register or login to websites with access to sensitive data using untraceable or false email addresses and/or phone numbers, or use other such scheming methods that compromise the traditional authentication processes currently in place for such websites. For example, a common exploit employed by fraudsters is called “account takeover” where a fraudster “tricks” or steals the login credentials (e.g., username and password) of a user, often via a piece of software that records a user's keystrokes (keylogger) or as a result of a security breach on a user's computer. These “stolen” login credentials then allow the fraudster access to the user's account. Often, the effect of such a breach can be devastating to website owners and users whose secure information may be accessed, or who may otherwise be defrauded as a result. The increased occurrence of fraud is especially concerning as more commerce and transactions move online and fraudster sophistication increases.
Concerned about the potential for fraud during Internet-based transactions, security researchers highly recommend the use of authentication methods that do not rely solely on traditional, single-control methods requiring only a username and password to gain access to a website or application. In fact, in its Supplement to Authentication in an Internet Banking Environment, the Federal Financial Intuitions Examination Council Agencies (“FFIEC”) acknowledged that there have been significant changes in security threats to Internet-based transactions, and expressed concern that the methods and controls traditionally in place have become less effective against the potential for malicious attacks that may compromise authentication and security. The FFIEC's report highly recommends use of a “layered” or “multifactor” security for authentication and fraud prevention for Internet-based transactions. Accordingly, one such recommended “effective control” is the use of “two-factor authentication”, or a method that utilizes at least an additional authentication layer in addition to the initial username and password login, often through a different access device.
The limited types of two-factor authentication that currently exist are centered on a first layer process that utilizes predetermined information that the user or registrant is expected to know, often referred to as “something you know,” e.g., the username and password. The second layer of authentication, often referred to as “something you have,” is then based on a physical item that the registrant or user has possession of and that can be used for verification of the user or registrant's identity, e.g., a physical token, or the registrant or user's mobile device or other such communicative device. Additionally, the second layer of verification can instead be achieved with biometric identification, such as fingerprint or voice recognition, often referred to as “something you are.” In two-factor authentication processes, the second layer of authentication requires the user or registrant to perform an additional step in addition to entry of a username and password before authentication can be completed. Unfortunately, because of the need for a second step, there has been limited adoption and proper utilization of two-factor authentication measures, even as security threats to Internet-based transactions continue to increase.
Overall, the examples herein of some prior or related systems and their associated limitations are intended to be illustrative and not exclusive. Other limitations of existing or prior systems will become apparent to those of skill in the art upon reading the following Detailed Description.